Overview

overview

10

Static

static

10

032ce80eea...76.exe

windows7_x64

10

032ce80eea...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    032ce80eea7e7c323b19eb5bafe9fc53d4d04ff2784e0b8590f11a9741d99876

  • Size

    216KB

  • Sample

    220212-n18sesbhg7

  • MD5

    10236e7f0c93e2ab3c6787fba63dc21d

  • SHA1

    03226c3533bc575434c409e2d2108ea7955ebb8b

  • SHA256

    032ce80eea7e7c323b19eb5bafe9fc53d4d04ff2784e0b8590f11a9741d99876

  • SHA512

    a729517bf3095c3b456102d150dd397de163b67ae8227a5d48d83361f3a97d0389173cdd03b5e82755bc2c2b1b8e05631bf6bf70f841a38c89aac814197b9dc0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      032ce80eea7e7c323b19eb5bafe9fc53d4d04ff2784e0b8590f11a9741d99876

    • Size

      216KB

    • MD5

      10236e7f0c93e2ab3c6787fba63dc21d

    • SHA1

      03226c3533bc575434c409e2d2108ea7955ebb8b

    • SHA256

      032ce80eea7e7c323b19eb5bafe9fc53d4d04ff2784e0b8590f11a9741d99876

    • SHA512

      a729517bf3095c3b456102d150dd397de163b67ae8227a5d48d83361f3a97d0389173cdd03b5e82755bc2c2b1b8e05631bf6bf70f841a38c89aac814197b9dc0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks